Overview

overview

10

Static

static

10

f45cb3e589...e5.exe

windows7_x64

10

f45cb3e589...e5.exe

windows10_x64

10

Analysis

  • max time kernel
    165s
  • max time network
    168s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 00:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f45cb3e589349f987092a654178e84520ffb34e1cd4a879b5f57ca4c570ab3e5.exe

  • Size

    116KB

  • MD5

    fa3516c08b30932538bb589f27530b26

  • SHA1

    017f0cc7ba64fd5add231f47aea15f3fb331e31d

  • SHA256

    f45cb3e589349f987092a654178e84520ffb34e1cd4a879b5f57ca4c570ab3e5

  • SHA512

    6f2d70f312e3593ed942f340fe052212a66dec53f2ff4f626738a1ad8e9530846fefab473be11ae4af37fcefa8d0abfb78d587164aecd2249071f43aad6b1960

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\164eki8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 164eki8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you are ready to buy decrypt key for unlock all your files, please write to [email protected] We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. 2jB6G19GdI+tXZLkON28e0YqRt4bvSYsrml06MfYGvZYxng0BUwLR5G7xM1qK7LQ 0oY4IGTAz9312CT2xrFUxREQ85Uc+j1jLHyQBb1zAIT+iTlybfFQI9OCtOI/8e1a AgeDHCAHZjBTh/RYEg4oi7LVvT66edZxK+Nt7IuPxgSOkQw06yRFKLotrK6xBwZf fJWnNDycUQeb7EKzJJ1U11zT9HMUFWfkUbEPp+XJJGGP6UOodi6dWAzaDfn6tl6E c3ceAedb3g5sGsC4dOQzHxE7sbobjbhizKMBPI4quQQ2W621NHDkITsHQpQHVwOB wQU3i/HI3wx2xDzPeqGG20A4h/0Srx4eLNGg9Y8LbZPa7ghPz3fOAbyEfsba1mRr 4+5MMg5p7eMLJvEsLYJv2U9KSmL3mxesU2aIs+uqG9RLwjtqx68AftNBEpZcrhiU TBB1m8e5jU4ATad76ggwQ0yXWgOYmRWHX6Gj36mJCrdTJan3ilplr6GWeboINqv1 WN/DqYgzNkHBa/WJoFdh4WGmgjuPLali0+nt9hoKdU7WGqnrG5rLdPBzjdd3TbOC 3JCpcm6HrFh3TLwoO3Yw+JmH5aDXzjVNp5VAqoSmUlfp05HT8O5xVPZyYu4Vigea MIiTH5NRPLvxJW2BFocRL58FSh275WKMYZIDlVSQ5FZS9g/bL+cFO7EVFQVMzA1V kRnwnvqjlVKrnW6lZnDMrWBVYBOo0Bq/QHpbj0nK1efJ9vpJMn3aE+SqU8KcMnlq rncvj3Lb7XTGABbG+I9KEt3DXK34eHhVPMzTOg+GA3OWXVdVioFempaoQ74zrzOy mYzziDfuwBwJVxt/jSniLVqPA7KO0n+qjdSnU1kphLbEBdQV1njnG/0YIaEmafyk Vh3Qi0Rb4JyS9f4KE+E+VA6eRjNKs0EJt1VGCOo6gFMVNa/UfWvv9lvsAle0k2tK B1MvYAT9ocJthYfiWEobw6O8239Pmh6Nym1xIpiVNLkDV3ldfVfz4XwRpCH8Gi2o KMeAgiLQvlW1QA6T27+nuq/O5lQj6S25+Gsboh1L7WIDTh1e/oSfk/zH70WgAgEQ Q/bfPZfNyZG8f7NFLFhoku8ZfIapNa01TSs3UabFP15g2rIHpg37NvPDGYTsWZRR gtyd1/o04pp+n20t30uD9Hcd9++5tL+UicJOWd595smhONFA7PYhkYvj5jDLrYU9 AkHtU7LBnwbce4qtXH8+5a5t8UpdvK5YTjhBzLsj+WaicLTsgW9eLZh9Sr3uVIsr 81jNbzI5bZQdIHpiMWkdTbsV ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0DC9440A2C4A9C1B http://decoder.re/0DC9440A2C4A9C1B

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f45cb3e589349f987092a654178e84520ffb34e1cd4a879b5f57ca4c570ab3e5.exe
    "C:\Users\Admin\AppData\Local\Temp\f45cb3e589349f987092a654178e84520ffb34e1cd4a879b5f57ca4c570ab3e5.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3924
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3972
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2236

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads